CVE-2022-46364-Poc

Exploit CVE-2022-46364 Apache CXF SSRF mediante MTOM XOP:Include | CVSS 9.8 CRÍTICO Vulnerabilidad Apache CXF -s -d -t, --target - Endpoint SOAP CXF vulnerable requerido -s, --ssrf-url - URL interna para exfiltrar requerido -d, --domain - Dominio objetivo por defecto: localhost --plain-soap -...

CVE-2024-28752

Apache CXF CVE-2024-28752 Entorno de reproducción Anuncio de vulnerabilidad: https://cxf.apache.org/security-advisories.data/CVE-2024-28752.txt Inicio del entorno samples/javafirstjaxwsfactorybean IDEA Inicie el servicio webservice a través de ServerStarter.java Compilación Usar JDK8 root@kitploi...

CVE-2022-46364-Proof-of-the-concept

CVE-2022-46364: Exploit de SSRF a LFI en Apache CXF MTOM XOP:Include ⚠️ DESCARGO DE RESPONSABILIDAD ESTA HERRAMIENTA ES SOLO PARA PRUEBAS DE SEGURIDAD EDUCATIVAS Y AUTORIZADAS Este exploit de prueba de concepto se proporciona con fines educativos para ayudar a los profesionales de seguridad a...

devarea

DevArea — HackTheBox Plataforma: HackTheBox SO: Linux Estado: Retirado — walkthrough completo publicado. Walkthrough completo: l3dsec.com/walkthroughs/devarea-htb Cadena de ataque root@kitploit: nmap → 21 FTP anon + 80 + 8080 Jetty + 8888 Hoverfly → FTP anon → employee-service.jar Apache CXF,...

asf__cxf_CVE-2019-17573_3-2-11

¡Bienvenido a Apache CXF! Apache CXF es un marco de trabajo de servicios de código abierto. CXF te ayuda a construir y desarrollar servicios mediante API de programación frontend, como JAX-WS y JAX-RS. Estos servicios pueden hablar una variedad de protocolos como SOAP, XML/HTTP, RESTful HTTP o...

asf__cxf_CVE-2016-6812_3-0-11

¡Bienvenido a Apache CXF! Apache CXF es un framework de servicios de código abierto. CXF te ayuda a construir y desarrollar servicios utilizando APIs de programación frontend, como JAX-WS y JAX-RS. Estos servicios pueden hablar una variedad de protocolos como SOAP, XML/HTTP, HTTP RESTful o CORBA ...

CVE-2022-46364

CVE-2022-46364 — Apache CXF MTOM/XOP SSRF lectura de archivos Exploit de prueba de concepto para CVE-2022-46364 — una vulnerabilidad de falsificación de solicitud del lado del servidor SSRF en el procesamiento de solicitudes MTOM/XOP de Apache CXF. Resumen de la vulnerabilidad CVE-2022-46364 afec...

CLEANSTART-2026-TK74523 Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place

Security vulnerability affects the wildfly package. Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place...

CVE-2022-46364-htb-ctf

Herramienta de Explotación SOAP DevArea CVE-2022-46364 Descripción Este exploit especializado está diseñado para el entorno DevArea en Hack The Box. Aprovecha una vulnerabilidad crítica en Apache CXF 3.2.14 CVE-2022-46364 para realizar Inclusión de Archivos Locales LFI y Falsificación de...

CVE-2022-46364---Apache-CXF-XOP-Include-LFI-PoC

Apache CXF XOP Include LFI CVE-2022-46364 Resumen Este repositorio contiene un exploit de Prueba de Concepto PoC para CVE-2022-46364 , una vulnerabilidad de Inclusión de Archivos Locales LFI en Apache CXF. La vulnerabilidad surge debido al manejo inadecuado de los elementos XOP XML-binary Optimiz...

Authentication Bypass

Apache CXF is vulnerable to Authentication Bypass. The vulnerability is due to insufficient validation of required claims in self-issued OIDC ID tokens, including issuer, subject, audience, time, and subjwk binding, which allows an attacker to craft malicious tokens and bypass authentication when...

Security Bulletin: IBM WebSphere Application Server Liberty is affected by an XML External Entity Injection vulnerability due to Apache CXF (CVE-2026-65432)

Summary There is a vulnerability in the Apache CXF library that affects IBM WebSphere Application Server Liberty with jaxws-2.2, xmlWS-3.0, xmlWS-4.0, wsSecurity-1.1 or wsAtomicTransaction-1.2 enabled. Vulnerability Details CVEID:CVE-2026-65432 DESCRIPTION: Apache CXF reads a top-level WSDL throu...

CVE-2022-46364-poc

CVE-2022-46364 — Apache CXF XOP:Include SSRF / LFI Autor: 0xmid00 Vulnerabilidad: SSRF / Lectura de archivos local via XOP:Include en solicitudes MTOM Afectado: Apache CXF 3.5.5 y 3.4.10 ¿Cuál es la vulnerabilidad? Apache CXF procesa mensajes MTOM Mecanismo de Optimización de Transmisión de...

Improper Authorization

Apache CXF is vulnerable to Improper Authorization. The vulnerability is due to revoked access and refresh tokens remaining valid and being reported as active by the token introspection service, which allows an attacker to continue using revoked tokens to access protected resources...

Improper Authorization

Apache CXF is vulnerable to Improper Authorization. The vulnerability is due to a flaw in the removeCodeGrant functionality that allows authorization codes to remain reusable, which allows an attacker who captures a valid authorization code to redeem it multiple times and obtain multiple valid...

Improper Input Validation

Apache CXF is vulnerable to Improper Input Validation. The vulnerability is due to JwtRequestCodeFilter copying security-sensitive claims from a signed request JWT into the authorization parameter map without proper validation, which allows an attacker with a validly signed JWT to replace...

Improper Authorization

Apache CXF is vulnerable to Improper Authorization. The vulnerability is due to the OAuth2 Dynamic Client Registration endpoint accepting and storing client-supplied scope values without validating them against an allowed scope list, which allows an attacker to self-assign privileged scopes durin...

Deserialization Of Untrusted Data

Apache CXF is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to native Java deserialization of inbound JMS ObjectMessage objects without type restrictions, which allows an attacker who can place messages on the JMS destination to submit malicious serialized objects that...

Improper Input Validation

Apache CXF is vulnerable to Improper Input Validation. The vulnerability is due to failure to validate the chash parameter when it is omitted by a non-compliant or misconfigured Identity Provider, which allows an attacker to substitute or inject an authorization code and potentially gain...

Security Bulletin: Multiple vulnerabilities found in CICS Transaction Gateway for Multiplatforms.

Summary Multiple vulnerabilities were identified in third-party components used by CICS Transaction Gateway for Multiplatforms, including IBM WebSphere Application Server, IBM WebSphere Application Server Liberty, Apache Tomcat Embed, Logback, Log4j, Jackson Databind, and various operating system...